What causes "password can not be empty" in vaxilu/x-ui?

Supply a non-empty password when calling UpdateFirstUser

password can not be empty

Error message

password can not be empty

What it means

UpdateFirstUser returns this error when the password argument is an empty string. Just like the username check, the service refuses to persist a blank password because doing so would effectively disable authentication for the first user account. The validation happens before any DB write.

Source

Thrown at web/service/user.go:58

		return nil
	}
	return user
}

func (s *UserService) UpdateUser(id int, username string, password string) error {
	db := database.GetDB()
	return db.Model(model.User{}).
		Where("id = ?", id).
		Update("username", username).
		Update("password", password).
		Error
}

func (s *UserService) UpdateFirstUser(username string, password string) error {
	if username == "" {
		return errors.New("username can not be empty")
	} else if password == "" {
		return errors.New("password can not be empty")
	}
	db := database.GetDB()
	user := &model.User{}
	err := db.Model(model.User{}).First(user).Error
	if database.IsNotFound(err) {
		user.Username = username
		user.Password = password
		return db.Model(model.User{}).Create(user).Error
	} else if err != nil {
		return err
	}
	user.Username = username
	user.Password = password
	return db.Save(user).Error
}

View on GitHub (pinned to 9c1be8c57a)

Solutions

Supply a non-empty password when calling UpdateFirstUser
Add binding:"required" (or min length) validation on the password field in the handler form
Enforce a minimum password length in client-side validation to reject whitespace-only values too

Example fix

// before
err := a.userService.UpdateFirstUser(form.Username, form.Password)
// after
if strings.TrimSpace(form.Password) == "" {
    jsonMsg(c, "设置", errors.New("password can not be empty")); return
}
err := a.userService.UpdateFirstUser(form.Username, form.Password)

Defensive patterns

Strategy: validation

Validate before calling

if strings.TrimSpace(password) == "" {
    return errors.New("password can not be empty")
}

Try / catch

if err := userService.UpdateFirstUser(username, password); err != nil {
    if err.Error() == "password can not be empty" {
        c.JSON(400, gin.H{"msg": "password is required"})
        return
    }
    c.JSON(500, gin.H{"msg": err.Error()})
}

Prevention

Require a minimum password length in form validation
Reject whitespace-only passwords
Mark the password input required in the UI
Never pass form fields straight to the service without checks

When it happens

Trigger: Calling UpdateFirstUser(username, ""), typically from updateSetting when the settings form had an empty password value passed through unchanged.

Common situations: User submitting the settings page without typing a new password; scripts calling the API with a missing password key; password managers autofilling only the username.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of vaxilu/x-ui@9c1be8c57a (2026-09-02). Data as JSON: /api/errors/c8cc1233282e8381. Report an issue: GitHub.